Colorado AI Act
Receipt evidence and the transition to Colorado's ADMT framework
Colorado SB 26-189 repeals and reenacts SB 24-205. Its automated decision-making technology (ADMT) deployer requirements apply to consequential decisions made on or after 1 January 2027. Asqav's colorado_ai report retains the SB 24-205 section mapping shown below. An assessment against the SB 26-189 ADMT requirements is not yet available.
Asqav signs submitted AI agent actions with ML-DSA, binds them to the deployer's policy artefact via policy_digest, and chains receipts so an auditor can reconstruct the period covered by an impact assessment without reading the underlying payload.
The receipt format is profiled in the IETF Internet-Draft draft-marques-asqav-compliance-receipts, which includes the SB 24-205 mapping to Sections 6-1-1703(2), 6-1-1703(3), and 6-1-1703(7). These references describe that report mapping, not the replacement ADMT obligations.
SB 24-205 report mapping
| Section | SB 24-205 requirement | Asqav binding |
|---|---|---|
| 6-1-1703(2) | Implement a risk-management policy and programme for the High-Risk AI System. | policy_digest resolves through the audit pack to the deployer's risk-management policy in force at action time. Risk-bearing actions carry the risk_class extension. |
| 6-1-1703(3) | Complete an impact assessment annually and within 90 days of any intentional and substantial modification. | Query type, policy_digest, and previousReceiptHash to identify the receipts in the assessment window, including any policy changes within that period. |
| 6-1-1703(7) | On determination of algorithmic discrimination, record the determination and the affected actions. | Emit a protectmcp:lifecycle receipt naming the affected action_ref values and a reason code. |
Bring-your-own KMS, customer-owned storage, and on-prem mode are available for deployer profiles that disallow outbound traffic. See the docs for the full mapping and the IETF draft for the binding text.